qilingframework / qilingframework/qiling
LDR error while loading windows shellcode
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
Describe the bug
The LDR table is wrong when loading windows shellcode.
The first record is not process image.
I find it's same as #1043 that was closed:
LDR sequence error
InLoadOrderLinks= ntdll, kernel32, ...
InMemoryOrderLinks= ntdll,kernel32, ...
InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)The correct order should be
InLoadOrderLinks=process, ntdll, kernel32, ...
InMemoryOrderLinks=process, ntdll, kernel32, ...
InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)
Sample Code
get kernel32 base by from PEB and InLoadOrderModuleList
from qiling import Qiling
from qiling.const import *
'''
40000 64A130000000 mov eax, dword ptr fs:[30] ; PEB
40006 8B400C mov eax, dword ptr [eax+0c] ; PEB_LDR_DATA
40009 8B400C mov eax, dword ptr [eax+0c] ; InLoadOrderModuleList, record of process image
4000C 8B00 mov eax, dword ptr [eax] ; next module, record of ntdll
4000E 8B00 mov eax, dword ptr [eax] ; next module, record of kernel32
40010 8B4018 mov eax, dword ptr [eax+18] ; base of kernel32
40013 C3 ret ; at last $EAX = base of kernel32
'''
shellcode = bytes.fromhex('64a1300000008b400c8b400c8b008b008b4018c3')
ql= Qiling(code=shellcode, archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS,
rootfs='examples/rootfs/x86_windows', verbose=QL_VERBOSE.DEBUG)
# ret, $eax should = base addr of kernel32.dll
ql.debugger = "qdb:0x40013"
ql.run()
Expected behavior
The first entry of LDR should be process image while loading windows shellcode.
Additional context
I checked the source code and found that when normal PE files are loaded, PE image is added to ldr first, while shellcode is not.
https://github.com/qilingframework/qiling/blob/master/qiling/loader/pe.py#L772
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the shellcode reproducer in the issue, then inspect qiling/loader/pe.py around line 772 and compare normal PE loading with shellcode loading. Verify the LDR lists while running the sample and confirm that the first InLoadOrderModuleList and InMemoryOrderModuleList entries are the process image, while the initialization list remains unchanged and EAX resolves kernel32.dll.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100